Описание
Security update for rubygem-activerecord-5_1
This update for rubygem-activerecord-5_1 fixes the following issues:
- CVE-2021-22880: Fixed possible DoS vector in PostgreSQL money type (bsc#1182169).
Список пакетов
openSUSE Leap 15.3
ruby2.5-rubygem-activerecord-5_1-5.1.4-5.3.3
Ссылки
- E-Mail link for openSUSE-SU-2021:3634-1
- SUSE Security Ratings
- SUSE Bug 1182169
- SUSE CVE CVE-2021-22880 page
Описание
The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the `money` type of the PostgreSQL adapter in Active Record to spend too much time in a regular expression, resulting in the potential for a DoS attack. This only impacts Rails applications that are using PostgreSQL along with money type columns that take user input.
Затронутые продукты
openSUSE Leap 15.3:ruby2.5-rubygem-activerecord-5_1-5.1.4-5.3.3
Ссылки
- CVE-2021-22880
- SUSE Bug 1182169
- SUSE Bug 1188335